An unusually disciplined local security scanner: SHA-pinned engines, zero scan-time egress, no telemetry, redacted secrets, a three-state honest evidence model, and rare candor about its own limits (narrow native rules, AI-drafted compliance mappings, heuristic prompt-injection detection). Well suited to agent-driven scan-fix-rescan security loops; not a substitute for deep audits, runtime testing, or compliance certification. MIT licensed, solo-maintained by Synvoya, with independent security review actively solicited.
CodeInspectus is a local-first, privacy-preserving MCP security scanner and CLI maintained by Synvoya. Any AI coding agent (Claude Code, Cursor, Codex, Windsurf, Cline, Aider) can invoke it to scan AI-generated / "vibe-coded" code for real vulnerabilities, map findings to code-level compliance-framework coverage, and drive a scan → fix → rescan loop — fully on your machine, no account, zero network egress at scan time. It orchestrates three OSS engines — Opengrep (SAST/OWASP Top 10), Gitleaks (secrets), and Trivy (dependency CVEs, IaC, SBOM) — plus first-party AI-code-specific checks (Supabase RLS / inverted authz, prompt-injection sinks, model tool arguments reaching shell sinks, client-writable user_metadata authorization, dangerous HTML rendering, Firebase public writes, GitHub Actions workflow risks, and more), shipping 88 curated detections normalized into a CWE-keyed schema. Engine binaries are SHA-pinned and signature-verified; there is no telemetry. Compliance mappings are code-level coverage only, never certification.
Prerequisites: Node.js ≥22 (Node 24 LTS recommended); cosign on PATH when Opengrep or Trivy binaries need installation (fail-closed verification; Gitleaks verifies by checksum and needs no cosign). Register once per machine with your client (e.g. Claude Code: claude mcp add- codeinspectus '{"command":"npx","args":["-y","codeinspectus"]}'; Cursor: add to mcp.; VS Code: code --add-mcp; Codex: codex mcp add or config.toml with tool_timeout_sec = 600 recommended). Then run npx codeinspectus repair-engines to install hash-verified engines and databases. Scans then perform zero network I/O. Re-verify binaries any time with npx codeinspectus verify-engines.
{"mcpServers":{"codeinspectus":{"command":"npx","args":["-y","codeinspectus"]}}}